Untrusted Content Is Not Instructions

An agent that reads email, web pages and documents will eventually read an instruction somebody else planted there. The fix is not a sterner prompt. It is deciding, per session, which powers the agent is allowed to hold at the same time.